chore: Publishes to npm with provenance flag

[oarbusi]

Proposed changes

npm does not natively support package signing, but provenance via GitHub Actions can be used.
publib-npm is a wrapper that publishes all .tgz files in your dist directory to npm.
As of now, publib-npm does not support passing the --provenance flag to npm publish.

Link to any related issue(s): CLOUDP-321621

Type of change:

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as
  expected)
• This change requires a documentation update

Required Checklist:

• I have signed the MongoDB CLA
• I have added tests that prove my fix is effective or that my feature works
• I have added any necessary documentation (if appropriate)
• I have run make fmt and formatted my code
• I have tested the CDK constructor in a CFN stack. See TESTING.md
• If changes include removal or addition of 3rd party GitHub actions, I updated our internal document. Reach out to the APIx Integration slack channel to get access to the internal document.

Further comments

[Copilot]

Pull Request Overview

This PR updates the GitHub Actions release workflow to publish to npm with the new provenance flag rather than relying on the publib-npm wrapper.

• Renames the release step to "Publish to npm with provenance".
• Replaces the publib-npm command with direct npm publish commands executed from the dist/js directory.
• Adjusts authentication environment variables to use NODE_AUTH_TOKEN.

Comments suppressed due to low confidence (1)

.github/workflows/release.yml:79

• [nitpick] Switching to NODE_AUTH_TOKEN changes the authentication setup compared to the previous settings (e.g. NPM_REGISTRY). Confirm that this change aligns with the intended publishing configuration for npm, especially if a custom registry is used.

NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

[lantoli]

have you been able to test it?

[oarbusi]

Hard to actually test without doing the release, but this command should be equivalent to what was being done before + the provenance flag